Measuring and Managing Security Risks

08/01/2008 | By Jon A. Schmidt

A voluntary rating program helps facilities professionals measure and rate their security risks

The events of 9/11 were a stark reminder that terrorist attacks have the potential to affect any building. Although government agencies are usually perceived as the most likely targets, the statistics tell a different story. According to the Terrorism Knowledge Base, which merged in March 2008 with the Global Terrorism Database (managed by the National Consortium for the Study of Terrorism and Responses to Terrorism [START] at the University of Maryland), there have been approximately 28,000 incidents, 99,000 injuries, and 48,000 fatalities worldwide over the 10-year period between 1998 and 2007. Roughly half of these incidents occurred at private-sector facilities.

In addition, according to the February 2006 issue of Buildings magazine, premises liability claims for other types of security incidents have been on the rise for several decades. In the 1960s and 1970s, the insurance industry generally dealt with about three claims per year, with an average settlement of less than $300,000. By the 1990s—even prior to 9/11—this skyrocketed to more than 100 annual claims, and typical settlements of about $1 million.

In light of these facts, building owners clearly need to be able to manage their security risks. But, as the old saying goes, you can't manage what you don't measure. And, measuring hasn't always been easy: There have been no broad, flexible, or simple tools available that offer a balanced, multidisciplinary approach and use consensus metrics.

The same situation once existed in the area of sustainability, which led to the creation of the Washington, D.C.-based U.S. Green Building Council (USGBC) and LEED® (Leadership in Energy and Environmental Design), its highly successful flagship program. Recognizing that similar problems call for similar solutions, in 2005, the Reston, VA-based American Society of Civil Engineers (ASCE) established the Building Security Council (BSC), a non-profit organization with a vision of enhancing public safety by promoting building security. Subsequently, BSC developed its own voluntary rating program, called PLUSSM (Promoting Logical Unified Security).

Rating Basics
PLUS ratings are applicable to office, retail, light industrial, manufacturing, healthcare, and educational facilities. As with LEED certification, a building owner who wishes to pursue a PLUS rating will need to retain an assessment team led by a licensed professional engineer or architect to prepare the application and assemble the necessary supporting documentation. This information typically includes drawings, photographs, cut sheets, and sealed declarations of compliance, especially for existing facilities. BSC reviews these materials carefully to confirm that the desired PLUS rating has indeed been earned.

The first step is completion of a questionnaire that addresses threat and consequence considerations. The facility being rated is assigned to one of four building classes: A, B, C, or D ("A" represents the highest risk and "D" represents the lowest risk). Extensive checklists then provide a menu of appropriate structural, physical, and operational countermeasures. Certain items are mandatory, but most have points associated with them in accordance with their implementation cost and mitigation value. Countermeasures that are legitimately not applicable to a particular facility are taken out of the equation, and bonus points may be awarded for innovative solutions that are not included in the checklists.

The assessment team begins at the lowest PLUS category ("Rated") and verifies that the building has all of the mandatory countermeasures, and receives at least 60 percent of the points available for the optional countermeasures. If the facility qualifies for 90 percent of the applicable points, it's eligible to move up to the next category ("Bronze"), which has a different checklist with different achievement and advancement thresholds, depending on the building class. The process continues in similar fashion through the "Silver" and "Gold" categories, and all the way up to a "Platinum" rating.

Rating System Summary

Rating BenefitsPLUS ratings from BSC offer at least three potential benefits to building owners:

Decision support. The rating process is a systematic evaluation of the facility's attractiveness as a target and the capability of countermeasures to defend against, respond to, or recover from an incident. By pursuing a PLUS rating for the building, the owner obtains the detailed information necessary to determine whether any additional steps are truly warranted.

Loss control.The countermeasure checklists serve as comprehensive, coordinated, and cost-effective roadmaps that guide building owners in taking reasonable steps to protect their facilities against a range of potential threats. Once a building receives a particular PLUS rating, the owner can be confident that doing what is necessary to move up to a higher category will legitimately improve the situation.

Liability mitigation. BSC independently verifies that the facility substantially complies with industry-accepted practices as codified in federal agency guidelines. In addition, under the Support Anti-Terrorism by Fostering Effective Technologies Act of 2002 (SAFETY Act), the owner of a building with a PLUS rating may be exempt from many third-party claims following a terrorist attack. BSC's PLUS rating program has been granted "Designation" as a Qualified Anti-Terrorism Technology (QATT) by the U.S. Department of Homeland Security (DHS) under the SAFETY Act. According to regulations adopted by the Department of Homeland Security, a cause of action for performance or nonperformance of a QATT in relation to an act of terrorism may be brought only against the seller of the QATT. The precise legal ramifications of obtaining a PLUS rating can be best evaluated by legal counsel.

Owners of PLUS-rated facilities will likely be better positioned to attract high-risk tenants, and may even be able to charge higher rents. Informal discussions with property/casualty insurers suggest that premium discounts for rated buildings are also a real possibility. Whether these kinds of market-based incentives will actually materialize or not remains to be seen.

Building security is a concern to every owner and should be addressed, as much as possible, in an integrated fashion. A PLUS rating from BSC can serve as a valuable tool for benchmarking a facility's current security posture and determining what additional protective steps—if any—should be considered.